How does KeePass master key derivation increase security?

Question

I don't understand how KeePass key derivation increases the security of the password db at all. First I'll try to explain what I understood from the key derivation described here. I'll use some pseudo code:

const WORKFACTOR = 6000;

var userKey = UserEnteresPassword();
var userKeyHash = SHA256(userKey);

var randomKey = GetStoredSecureRandomKey();

var tmpKey = userKeyHash;
for(i = 0; i < WORKFACTOR; i++)
{
    tmpKey = AES(tmpKey, randomKey);
}

var finalKey = SHA256(tmpKey);

Then it uses the final finalKey to encrpt the password database. This is then stored on the hard drive.

If I now want to decrypt the password database, why would I have to use this key derivation function? I could simply directly guess the finalKey instead of guessing userKey and having it run though this function. So I would save all the time I would othwise need for this key derivation function.

I am aware that, if I simply guess the finalKey I won't be able to get userKey, but I won't need that since I already have finalKey, I can simply decrypt the password db with. I am not interested in userKey at all.

Or is this completly about dictionary attacks to prevent an attack from using commly known words/passwords and simply see if the db decrypts?

Answer 1

The key derivation is entirely to take the users password and turn it into a 256bit long key to use whatever it's length and hopefully in a secure way.

If running a pure brute-force, yes one could directly guess the key by cycling through all possible patterns that are 256bit long, for this one wants to be sure the key derivation can't narrow the possible key space so all 256bit long keys are still possibilities.

One could try running a dictionary attack and passing all the dictionary words through the key derivation function to generate keys to try one of the points of the key derivation is to make this slow enough that this is not sensible on given hardware.

Now there are some flaws in the pseudo-code you gave depending on a couple of functions (CreateSecureRandomKey() would need to give the same data every time one opens the database to get the same key to use), I'm not sure as I would have to look into key derivation in KeePass myself.

Answer 2

Look at how difficult it is to brute-force finalKey:

2²⁵⁶ = 2⁶⁴⁴

2⁶⁴ ~= 4 * 10⁹

You could have four cubic arrays of 1000x1000x1000 processers, running at 4 giga-guesses/sec each, for 125 years, and your chances of guessing it would be a hundred times lower than winning the lottery.

Using a raw password would almost certainly make it easier to brute force. Few people use something like a randomly generated string of 64 hexadecimal digits (64 = 256 / 4) for a regular KeePass password.

Answer 3

This is called key stretching. You can read all about it in the Wikipedia article.